home User Guide Getting Started Help Center Documentation Community Training Certification
Looker keyboard_arrow_down
language keyboard_arrow_down
Looker documentation will be moving to cloud.google.com in mid-2022!
All the information you rely on will be migrated and all docs.looker.com URLs will be redirected to the appropriate page.
Google authentication

The Google Authentication page in the Authentication section of the Admin menu lets you set up Google OAuth on the Looker side.

Feature overview

If desired, Looker can perform authentication via Google OAuth, for users that have accounts registered with Google Workspace.

A user’s Google avatar appears in the navigation bar instead of the standard user symbol:

The following behaviors might affect your decision to use Google OAuth:

Preliminary requirements

Using Google OAuth requires the following:

Enabling authentication with Google OAuth

Enabling authentication with Google OAuth requires an administrator to perform steps both on the Google side, and on the Looker side, as described in the following sections.

Setup on the Google side

The steps for enabling Google OAuth on the Google side are described below. Google’s generic description of these steps is on the Google support page on setting up OAuth 2.0. You can find documentation on the Google Dev Console from the Google Cloud Platform Console Help page.

  1. Go to the Google Cloud Platform Console.

  2. Click the down arrow in the Select a project drop-down. You may see the name of an existing project in the drop-down; click the down arrow regardless, and it will take you to the option to create a new project:

  3. In the Select a project page, click New Project:

    Google displays the New Project page.

  4. Fill out the information on the New Project page and click Create.

    When Google is done creating your new project, Google returns you to the Google Cloud Platform Console and shows your new project.

  5. In the left menu, select APIs & Services > Credentials:

  6. On the Credentials page, click the Create credentials button, and select OAuth client ID from the drop-down menu.

    Google displays the Create OAuth client ID page.

  7. Google requires that you configure an OAuth consent screen, which lets your users choose how to grant access to their private data and provides a link to your organization’s terms of service and privacy policy. Click Configure consent screen. (If you have configured OAuth consent for a previous project, you will not see this option, and you can skip to step 13.)

    Google displays the OAuth consent screen page.

  8. Enter the domain of your Looker instance in the Authorized domains field. For example, if Looker hosts your instance at https://mycompany.looker.com, the domain is looker.com. For customer-hosted Looker deployments, enter the domain on which you host Looker.

  9. Configure your OAuth consent screen and click Save and Continue.

    For information about configuring the Google OAuth consent screen, see the Setting up OAuth 2.0 Google support page.

  10. On the Scopes page, click Save and Continue. No additional scope configuration is required.

  11. On the Summary page, click Back to Dashboard.

    Google returns you to the Create OAuth client ID page.

  12. Under Application type, select Web application.

  13. In the Name field, enter a name for your OAuth client ID.

  14. In the Authorized JavaScript origins field, enter the URL to your Looker instance, including the https://. For example:

  1. In the Authorized redirect URIs field, enter the URL to your Looker instance, followed by /oauth2callback. For example: https://mycompany.looker.com/oauth2callback or https://looker.mycompany.com:9999/oauth2callback.

  2. Click Create.

  3. Copy your client ID and your client secret values — you will need them to configure Looker.

Setup on the Looker side

The steps for enabling Google OAuth on the Looker side are below.

  1. From the Looker application, while logged in as an administrator, click the Admin drop-down to open the Admin menu.

  2. Under the Authentication group, click Google. Looker displays the Google Authentication page:

  3. Click Enabled to display and edit Google OAuth settings. (This does not immediately enable Google authentication; you must confirm your choice later).

  4. Enter your Google Auth Settings:

  1. Enter Migration Options, which control behavior of the Looker instance during the transition to Google OAuth:

  1. Click Test Google Authentication to use the current settings and attempt to authenticate the current browser in a new window. This action does not save the current settings or apply them to the Looker instance.

    If you are not logged into Google, you are prompted to log in and asked for consent to use your Google account information. This flow uses the custom Consent screen settings you used in the Google-side setup.

    Upon success, a User Info section displays with your name, email, domain, etc. Presence of this User Info section shows that this user would be successfully authenticated by Looker.

    Upon failure, error descriptions appear. Below are some common issues:

    • Miscopied Client ID or Client Secret. These must be carefully copied and pasted in full.
    • User is out of domain. If you see a Person Info section, but no User Info, it is probably because the user is not in the domain you specified. This shows that the person has authenticated themselves to Google correctly, but they are not using a Google account that you have chosen to allow into your Looker instance.
    • Looker URL and/or redirect URL not set up correctly in Google for your Looker.
  2. To save and apply changes, check I have confirmed the configuration above and want to enable applying it globally. Click Update.

After you enable Google authentication, users can authenticate only through Google OAuth. If you did not enable the Merge by email setting for existing accounts, every new Google-authenticated login creates a new Looker user. Existing email/password logins are not usable at the same time that Google authentication is enabled.


Enabling email logins while Google Auth is enabled

New Google accounts automatically get access to Looker, so there is no need to add users that are in your Google Domain.

To add a user via e-mail address that is not in your Google Domain:

  1. Enable the Alternate login for admins and specified users option on the Google Auth page
  2. Create or modify an existing user role to add the login_special_email permission
  3. Go to Add Users from the users panel (/admin/users/new)
  4. Add the e-mail address(es) you would like to include, and the roles those users should have, which must include a role with the login_special_email permission
  5. Those users are now able to log in via https://mycompany.looker.com/login/email (hidden URL)

To enable alternate logins using the Looker API, see the Enabling the alternate login option documentation page.

Disabling Google Auth once it has been enabled

If you’d like to disable Google Authentication for your Looker instance after it has already been enabled, there are some things to think about:

This is why, currently, we suggest avoiding this route. If you must go down this path there may be a method to fix the orphaned accounts by using the Looker API. Reach out to Looker Support for additional guidance.